The Brazilian General Data Protection Act (in Portuguese, Lei Geral de Proteção de Dados, or, LGPD) protects personal data of all individuals in Brazil, no matter where the data collector is located. This means any organization, including Index Exchange (IX), that serves the Brazilian market, whether they have offices in the country or not, is subject to the LGPD.
How the LGPD applies to IX
Similar to the GDPR, the LGPD requires organizations to have a lawful basis to process the personal data of residents in Brazil. The LGPD includes 10 lawful bases for processing data. The ones applicable to IX include:
- With the consent of the data subject.
- To fulfill the legitimate interests of the controller or a third party. This includes matters such as contractual obligations.
How IX supports LGPD
IX values the privacy of users and takes seriously our obligations to comply with applicable law. Based on internal assessment, IX will be relying on our legitimate interest, as provided for in the LGPD, to process limited personal data of users in Brazil. IX also ensures users may exercise their rights regarding access, deletion, and opt-out under the LGPD.